Practice management software.

The buyer's two questions.

Most legal-practice-management-software (PMS) reviews answer one question: what does it do? Features, integrations, pricing, user experience. That question matters, but in 2026 it has stopped being the only one.

The second question, increasingly the more consequential one, is: what does it do with the data you put into it? Every major PMS now bundles or partners with generative AI. The features look similar across vendors. The data flows that power them, and the contractual rights each vendor has reserved over your client information, are not similar at all.

This article reads the actual contracts and privacy policies of the four PMS platforms most U.S. solo and small firms are evaluating in 2026: Clio, MyCase, Smokeball, and PracticePanther. The objective is to make the second question answerable from primary sources, before you sign.

One framing note before going further. For larger firms with procurement budgets and outside counsel review, contract clauses can sometimes be redlined. For solo and small firms, that is usually not the practical reality: PMS contracts are click-through SaaS, accept-as-is. The realistic question is whether the contract you'd be accepting matches your obligations under ABA Formal Opinion 512 and your state's bar guidance. IXSOR's AI Vendor Diligence piece covers the procurement-side framework for firms with negotiating room. This piece is the read-once-decide-once companion for everyone else.

The market in 2026.

Three structural changes shape the PMS landscape in 2026.

Clio's vLex acquisition. In November 2025, Clio acquired legal research provider vLex for approximately $1 billion. The acquisition gave Clio ownership of Vincent, vLex's generative-AI legal-research platform, and announced a new product line called Clio Work that combines practice management with research and an AI workspace. Vincent is now bundled into Clio's offerings.

Smokeball's Thomson Reuters partnership. In March 2026, Smokeball announced a strategic partnership embedding Thomson Reuters' CoCounsel into Smokeball's practice management software, alongside Smokeball's own AI assistant Archie. The companies position the combination as a small-firm-targeted alternative to Clio's stack.

The 8am consolidation. MyCase is owned by 8am (formerly AffiniPay), which also owns LawPay (legal payments), CASEpeer (personal injury PMS), and Docketwise (immigration PMS). The 8am portfolio operates under a unified privacy policy that, as discussed below, materially shapes what happens to data submitted to MyCase.

The consequence for buyers: there are fewer truly independent vendors than there appear to be at first glance, and the AI features of each platform are increasingly powered by a small set of underlying providers (Anthropic, OpenAI, Thomson Reuters, vLex). The vendor's contractual posture, not the underlying model, is what differentiates one platform from another for confidentiality purposes.

The AI feature taxonomy.

Across the four PMS platforms covered here, the generative-AI features fall into a small number of categories. The names differ; the underlying functions are similar.

• Document summarisation. Generate a short summary of a long file (deposition, contract, court order). Available in some form on all four.
• Document drafting. Generate a first draft of a letter, demand, motion, or contract from prompt-supplied facts. Available on Clio, MyCase, Smokeball.
• Text editing. Rewrite for tone, clarity, grammar; adjust to a target reading level. MyCase IQ leads with this; Clio and Smokeball offer it within drafting workflows.
• Conversational interface / matter Q&A. Ask questions about a specific matter file in natural language; the answers come back from the firm's own matter data, not the open web. Smokeball Archie and MyCase IQ both market this; Clio Manage AI offers something similar within Clio Manage.
• Legal research. Search caselaw and statutes through an AI-augmented interface. Clio's Vincent (via vLex acquisition); Smokeball's CoCounsel partnership; MyCase has not announced a research product as of mid-2026.
• Intake automation. Classify incoming leads, generate intake summaries, route to appropriate matter types. Available on Clio, MyCase.
• Time capture and billing. Auto-generate billable-time entries from matter activity. Available across the platform tier on Clio, MyCase, Smokeball.

The features are convergent. The differentiation lives elsewhere.

The "training data" question, broadened.

Behind the diligence framework on the next page sits a broader question that practitioners should not pretend isn't there.

If the operative concern with AI clauses is "the vendor uses customer data to improve their product," that concern is not new and not unique to AI. It is the default contractual posture of nearly every modern software product the practising bar has used for two decades. Word and Office use telemetry. The operating system on the lawyer's workstation reports usage data to Apple or Microsoft. Web browsers send navigation data. Email clients track which messages were opened. Practice management software has long used click-tracking, heatmaps, A/B testing, and crash analytics, all customer-data-driven product improvement that predate the generative-AI wave by twenty years.

The bar has not, historically, treated this category of data flow as a Rule 1.6 problem. The implicit reasoning is that aggregated, de-identified telemetry is a different category from the substantive content of a client matter, even if the line between them is fuzzy.

The AI training-data clauses raise a question only insofar as the practitioner can articulate what is materially different about them, and the answer is harder than it looks. Telemetry can become AI training data on the same contractual authority. Hybrid uses already exist (UX heatmaps inside an AI product are simultaneously telemetry and AI-context data). Most "service improvement" clauses are broad enough to cover the bridge by design. The categorical line at the centre of the 2026 AI cases is not as stable as the opinions assume.

The doctrinal version of that question, whether the 2026 AI cases (Heppner, Warner, Tremblay) and bar opinions rest on a categorical line that holds up, is the subject of a forthcoming companion piece. For the buyer's guide that follows, hold this much in mind: the question is not just "is this AI clause OK?" but "over the lifetime of this contract, what are the uses to which any data the vendor collects can lawfully be put?"

What "AI-aware diligence" means.

For Layer 1 of the confidentiality analysis covered in IXSOR's ChatGPT Confidentiality piece, the relevant question is whether the vendor's contract and privacy policy permit data uses that conflict with the lawyer's Model Rule 1.6 obligation. For PMS specifically, six contractual observations matter most.

1. Training use of customer data. Does the vendor reserve the right to use prompts, outputs, or stored matter data to train AI models, including third-party models? If yes, is there a default opt-out? Is opt-out available on the tier the firm is buying?
2. Sub-processor / LLM provider chain. When the vendor's AI features run, does the data flow to a third-party LLM provider (OpenAI, Anthropic, Google)? Is the sub-processor list public and current?
3. Retention windows. How long does the vendor retain prompts and outputs? Is the retention window contractually defined, or only "as long as necessary"?
4. Governmental disclosure language. What standard does the vendor apply to disclosing customer data to law enforcement or regulatory authorities? Is notice given to the firm?
5. Anonymisation posture. Does the vendor anonymise data before any service-improvement use? Is the anonymisation methodology described?
6. Tier differentiation. Are the privacy commitments uniform across tiers, or are stricter terms only available on enterprise plans the firm is unlikely to buy?

Each vendor below is read against these six observations from primary sources: the actual privacy policy and terms of service operative as of mid-2026.

Clio.

Headquarters: Burnaby, British Columbia, Canada (with substantial U.S. operations). Founded: 2008. Estimated U.S. user base: largest of the U.S.-targeted PMS platforms, in the high tens of thousands of firms.

AI features in 2026: Manage AI (formerly Clio Duo), the in-product AI assistant for case management , summaries, document analysis, smart task prioritisation. Vincent, the AI legal research product acquired via vLex in November 2025. Clio Work, the AI workspace bundle combining Vincent with Clio Manage. AI features are tier-gated; the most capable AI features sit in Clio's higher-priced plans.

Privacy posture (from clio.com/privacy): anonymisation-first. The policy authorises Clio to "anonymize and aggregate any of the personal information we collect (so that it does not identify you)" before using it for "testing our IT systems, research, data analysis, improving the Clio Service and developing new products." The policy does not contain a dedicated AI-training clause that would specifically authorise customer data being used to train large language models, but the service-improvement clause is broad enough that careful readers should ask Clio specifically.

Retention: not specified by duration. Personal information retained "for as long as necessary to fulfill the purposes we collected it for," considering "amount, nature, and sensitivity" and "applicable legal requirements."

Third-party disclosure: Clio shares data with "business partners, vendors, suppliers, and subcontractors who perform services on our behalf." Government disclosure: "in response to lawful requests by public authorities, including to meet law enforcement requirements." Data may also be disclosed during "merger, sale of assets or shares, reorganization, financing, change of control."

Tier differentiation: the policy applies uniformly across all Clio products including the recently-acquired vLex platform.

Diligence questions for Clio: (1) Are prompts and outputs from Manage AI and Vincent used to train Clio's models or any third-party model? (2) Which sub-processors / LLM providers receive prompt data, and is the list public? (3) Is there a contractually-defined retention window for AI prompts and outputs separate from general document retention?

MyCase (8am).

Headquarters: Austin, Texas (parent 8am, formerly AffiniPay). Founded: 2010 (acquired by AffiniPay 2020; rebranded 8am 2025). Estimated U.S. user base: second-largest PMS by U.S. firm count.

AI features in 2026: MyCase IQ (also marketed as 8am IQ), the gen-AI feature set spanning text editing, document summaries, and a conversational case-Q&A interface. AI features available on Pro and Advanced tiers.

Privacy posture (from the unified 8am privacy policy): of the four vendors covered here, the most expansive in what it reserves. The policy states: "we use and disclose this information as necessary in connection with the performance, development, and improvement of Platform. In particular, we use and disclose this information to provide, support, and deliver our AI-powered tools and features...to maintain and improve the accuracy, reliability, and performance of our AI-powered tools; to develop new AI-powered features and Services." On its face, the clause authorises customer data use for AI feature development.

Separately, the policy discloses sub-processor flow to third-party LLM providers: "when our Customers or Website visitors use our AI-powered tools, including 8am IQ...certain information is processed by third-party technology providers that power our AI tools, including large language model (LLM) providers." The policy does not name the LLM providers in the public document.

Retention: indefinite, tied to service use. Data retained "for as long as you use our Services or as necessary to fulfill the purposes for which it was collected."

Third-party disclosure: broad. Authorises disclosure "as we believe necessary: (i) under applicable law; (ii) to enforce applicable terms and conditions...(v) to respond to requests from courts, law enforcement agencies, regulatory agencies." Does not commit to providing notice to the customer firm before complying.

Tier differentiation: the policy applies uniformly. End users (the firm's clients whose data is in MyCase) have diminished direct rights; "if you are an End User, please contact the law firm...we may only process your privacy rights-related requests with the express consent of that firm or business."

Diligence questions for MyCase: (1) Which specific LLM providers receive customer prompts, and what are their data-handling commitments? (2) Is opt-out from AI training and feature development available, and on which tier? (3) What is the actual retention window for AI prompts?

Smokeball.

Headquarters: Chicago, Illinois (with Australian roots). Founded: 2010. Estimated U.S. user base: smaller than Clio or MyCase, with concentrated penetration in solo and small firms.

AI features in 2026: Archie, Smokeball's own AI matter assistant (matter-specific queries, document summaries, file comparison, drafting). Plus, from March 2026, Thomson Reuters CoCounsel is integrated into Smokeball's practice-management product, providing AI legal research, document analysis, and drafting through the partnership.

Privacy posture: the strongest stated posture of the four vendors covered. Smokeball publicly characterises Archie as operating in a "ring-fenced security environment where client data is never shared or used to train external models." If the contractual terms operative for the firm signing up match this public claim, this is the most restrictive AI-data-handling commitment in the PMS market.

The CoCounsel integration introduces Thomson Reuters as a sub-processor for queries that route through CoCounsel. Thomson Reuters' own data-handling commitments for CoCounsel are documented in TR's CoCounsel terms; firms should read those separately, as CoCounsel queries are governed by Thomson Reuters' contracts, not Smokeball's.

Retention and third-party disclosure: Smokeball's published terms of service should be read directly for the specific firm's matter; the public marketing claim of ring-fenced data should be verified by reference to the actual contract a firm is presented at sign-up.

Tier differentiation: not publicly specified. Whether the ring-fenced commitment applies uniformly or only at certain tiers should be confirmed in writing before signing.

Diligence questions for Smokeball: (1) Is the "ring-fenced, no external model training" language in the actual signing contract, not just the marketing copy? (2) Does Archie's data-handling differ from CoCounsel's, and is the boundary between them clear to the user when the feature is invoked? (3) What is Thomson Reuters' published data-handling commitment for CoCounsel queries originating from Smokeball?

PracticePanther.

Headquarters: Miami, Florida. Founded: 2012. Parent: Paradigm, which also owns MerusCase, Bill4Time, Headnote, and LollyLaw , all under common ownership.

AI features in 2026: PracticePanther markets less publicly about its specific AI-feature implementation than Clio, MyCase, or Smokeball. As of mid-2026, the company's blog and product pages discuss AI in general terms rather than naming a flagship AI product. This may reflect a deliberate market-positioning choice (less AI-forward than competitors) or an in-progress rollout. Either way, the practical buyer's response is the same: ask in writing what AI features are bundled in the tier under consideration, what they do, and what data they touch.

Privacy posture: PracticePanther's published privacy policy and terms of service should be read directly. The parent-company structure (Paradigm portfolio) means data-handling commitments may apply across multiple sister products, and the buyer should confirm whether Paradigm's portfolio-wide policy or PracticePanther's product-specific terms govern.

Retention and third-party disclosure: as with all PMS, read the actual policy operative on the firm's contract.

Tier differentiation: not publicly specified for AI features. Verify in writing.

Diligence questions for PracticePanther: (1) What specific AI features are bundled, and are any of them powered by third-party LLM providers? (2) Does the privacy policy applicable to the firm's contract include AI-specific data-handling language, or only generic SaaS terms? (3) How does PracticePanther differ from sister Paradigm products on these questions?

Smaller and specialty platforms.

Beyond the four covered above, several PMS platforms target specific firm sizes or practice areas. Buyers in those markets should run the same six-observation framework against each platform's actual privacy policy.

• Filevine , litigation-focused, strong in personal injury / mass torts; positions itself as enterprise-grade.
• Centerbase , mid-market full-feature PMS; less consumer-marketed than Clio or MyCase.
• Zola Suite , mid-market PMS with strong accounting integration.
• AbacusLaw , long-established Caret Legal product; more legacy than AI-forward.
• MerusCase , Paradigm portfolio, similar to PracticePanther; targets workers' comp and litigation practices.
• Tabs3 / PracticeMaster , long-running on-premise option, lower AI-feature exposure than cloud-native competitors.

The framework is the same. The contractual questions are the same. The data flows are vendor-specific.

Affiliates, referrals, and what review sites earn.

One structural feature of the PMS-review market deserves explicit acknowledgement before reading any review of these platforms (including this one).

Most PMS vendors operate referral or partner-affiliate programs. Clio's Channel Partner Program pays commissions on referrals and runs an additional individual referral program (currently $750 per converted firm). MyCase operates a Consultant Program that pays a percentage of subscription fees. PracticePanther's affiliate program pays 5% of first-year fees at the standard tier and 12% on annual contracts at the preferred-partner tier (notably, current law firms are not eligible). Smokeball's referral program pays a flat $300 per converted firm. The economics: a partner refers a firm; the firm signs up; the partner earns either a percentage of subscription revenue or a flat per-conversion bonus.

Most general legal-software review sites (Capterra, Software Advice, GetApp, G2) and many legal-specific review sites earn revenue from these vendor relationships. Capterra's published policies require disclosure when reviews are submitted in exchange for incentives, in compliance with FTC Endorsement Guidelines, and a "Reviewer Source" icon flags incentivised reviews. The disclosure infrastructure exists. Whether any individual review is materially shaped by the affiliate relationship is harder to verify from outside.

The relevance for buyers: a review that praises a specific PMS may be earned commission, sponsored content, an honest evaluation, or some combination, and the disclosure language varies. The substantive question , what does this vendor do with the data , is not dependent on review-site affiliation, but the framing and tone of any review can be.

IXSOR's disclosure for this article. IXSOR participates in vendor referral programs where available. Where this article links to a vendor with whom IXSOR has an active referral relationship, that link may be referral-tracked and may earn IXSOR a commission if a reader signs up. The analysis is conducted independently of commission economics: vendors are included on the basis of market presence, irrespective of whether IXSOR earns from a sign-up; the analysis reads each vendor's actual privacy policy, terms of service, and ABA / state bar guidance directly; and where the analysis is critical of a vendor, that view is not modulated by a referral relationship. Where it is favourable, it is also not. This disclosure is given so the reader can weight the analysis appropriately, and complies with the FTC Endorsement Guides.

Decision framework.

Across the four, the right call depends on what your firm cares about most.

For firms where confidentiality concern is highest (criminal defence, family law with sensitive children's matters, government investigations, immigration with vulnerable populations): Smokeball's public ring-fenced commitment is, on the face of the marketing claim, the most restrictive AI-data-handling stance available. The buyer should verify the claim appears in the actual signing contract, not only in marketing copy. Clio is in the middle of the field on Layer 1; MyCase's parent-company privacy policy is the most permissive of the four for AI training and LLM-provider routing.

For firms prioritising AI feature breadth: Clio's combined Manage AI plus Vincent stack is the most extensive AI-feature set, particularly after the vLex acquisition added research capability. Smokeball plus CoCounsel approaches similar breadth with a different stated privacy posture. MyCase is feature-narrower and tier-gated.

For firms with multi-product needs (PMS plus payments plus immigration plus PI): 8am's portfolio (MyCase, LawPay, CASEpeer, Docketwise) operates under a unified privacy policy; the integration is real but the data-handling commitments apply across all of them. This is convenience for the firm and concentrated exposure to the parent company's policy positions.

For firms moving from a non-AI legacy platform: PracticePanther's relatively muted AI marketing may match a buyer's preference for a platform that is not aggressively AI-forward. Verify in writing what AI features are present and what they do.

For all firms, the decision framework reduces to: read the actual contract once, document the analysis (so the diligence is auditable later), and re-read every twelve months as both AI features and underlying contracts continue to evolve.

Operational checklist.

• Read the actual signing contract, not the marketing site. The privacy policy linked from the homepage is the operative document.
• Document the read. A one-page memo per vendor, dated, kept in the firm's records. The diligence is auditable later under ABA Op. 512.
• Ask the six contractual questions (training use, sub-processors, retention, government disclosure, anonymisation, tier differentiation) in writing to vendor sales. Save the response.
• Confirm the tier you are buying is governed by the privacy commitments you read. Some vendors apply stricter terms only on enterprise tiers smaller firms are unlikely to buy.
• Set a 12-month re-review reminder. AI features and the contracts behind them are changing fast.
• Cross-reference the second-layer (litigation discoverability) analysis in IXSOR's ChatGPT Confidentiality piece. Layer 1 (vendor confidentiality) is what this article covers; Layer 2 (whether AI use is protected work product or privileged in litigation) is a separate analysis with the same factual inputs.
• Note any review-site affiliations. If the review you are reading earns from the vendor, that is not disqualifying; it is information.
• Document your client-disclosure approach if the firm's jurisdiction (e.g. NC under FEO 2024-1) requires it.

Citations and further reading.

Vendor primary sources (operative as of mid-2026):

• Clio , privacy policy, product pages, Channel Partner Program
• MyCase / 8am , 8am unified privacy policy, MyCase product pages, Consultant Program
• Smokeball , product pages, referral program, including Archie and the Thomson Reuters / CoCounsel partnership announcement
• PracticePanther , product pages, affiliate program, terms and privacy policy linked from the product pages

Ethics and procedural authorities:

• ABA Model Rule 1.6 , confidentiality of client information.
• ABA Formal Opinion 512 , generative AI obligations under the Model Rules.
• FTC Endorsement Guides , disclosure standards for review sites.

IXSOR cross-references:

• AI Vendor Diligence: Contract Clauses to Redline , the procurement-side framework for firms with negotiating room.
• Is ChatGPT Confidential for Legal Work? , the two-layer confidentiality analysis (Layer 1 vendor / Layer 2 discoverability).
• ABA Formal Opinion 512: An Implementation Playbook , the rule-by-rule operational guide.
• NC State Bar 2024 FEO 1 , the North Carolina ethics-opinion reading; particularly relevant to the Rule 5.3 framing of AI vendors.
• State Bar AI Opinions: A Comparative Tracker , multi-state ethics-guidance map.

This article analyses publicly available vendor privacy policies, terms of service, and product documentation operative as of mid-2026, supplemented by primary ethics authorities. It is not legal advice and does not establish an attorney-client relationship. Vendor terms change; readers should verify current terms before relying on this analysis. IXSOR participates in vendor referral programs where available; see Section 11 for the full disclosure.

About the author.